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We introduce a new primitive for quantum communication that we term "state targeting" wherein 
the goal is to pass a test for a target state even though the system upon which the test is performed 
is submitted prior to learning the target state's identity. Success in state targeting can be described 
as having some control over the outcome of the test. We show that increasing one's control above 
a minimum amount implies an unavoidable increase in the probability of failing the test. This is 
analogous to the unavoidable disturbance to a quantum state that results from gaining information 
about its identity, and can be shown to be a purely quantum effect. We provide some applications of 
the results to the security analysis of cryptographic tasks implemented between remote antagonistic 
parties. Although we focus on weak coin flipping, the results are significant for other two-party 
protocols, such as strong coin flipping, partially binding and concealing bit commitment, and bit 
escrow. Furthermore, the results have significance not only for the traditional notion of security in 
cryptography, that of restricting a cheater's ability to bias the outcome of the protocol, but also 
on a novel notion of security that arises only in the quantum context, that of cheat-sensitivity. 
Finally, our analysis of state targeting leads to some interesting secondary results, for instance, a 
generalization of Uhlmann's theorem and an operational interpretation of the fidelity between two 
mixed states. 



I. INTRODUCTION 

It is well known that quantum theory allows for the 
implementation of cryptographic tasks with a degree of 
information-theoretic security that cannot be achieved 
classically, with key distribution being the most famous 
example Particularly interesting among these tasks 
are the so-called "post-cold- war" applications of cryptog- 
raphy, wherein two remote and mistrustful parties seek to 
cooperate towards some end. Examples of these are bit 
commitment strong coin flipping 0,13, weak coin 

flipping 0, bit escrow and two-party secure compu- 
tation [9||. In this paper, we focus on elucidating a certain 
primitive we have identified as accounting for the ability 
of certain quantum two-party cryptographic protocols to 
outperform their classical counterparts. 

We begin by recalling a more familiar such primitive, 
specifically state estimation [Tol |: A system is prepared 
in one of a set of states, and passed on to an estimator. 
Typically, the task of the estimator is to try, as best as 
possible, to determine which of the states describes the 
system. Imagine, however, that the estimator is asked 
to announce his guess of the state and then is asked to 
resubmit the system, which is subsequently subjected to 
a pass/fail test for still being in the initially prepared 
state. In this case, the estimator's task is to guess the 
state without disturbing it. 1 By doing nothing to the sys- 
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tcm, the estimator can make a random guess and avoid 
creating any disturbance. However, it is well known that 
any interaction with the system that leads to a greater 
probability of guessing correctly will necessarily also lead 
to a disturbance of the state This phenomena is 

extremely important - for instance, it underlies the pos- 
sibility of quantum key distribution. 

The focus of this paper is the task of passing a test for 
a target state, even though the system upon which the 
test is performed must be submitted prior to learning the 
target state's identity. We call this task state targeting. 
State targeting is built of the same elements as the sort 
of state estimation task just discussed: There is a system 
and a set of states, one of which is distinguished. There 
is also a classical announcement of a state drawn from 
the specified set, and the most desirable announcement 
is an announcement of the distinguished state. Finally, 
there is a pass/fail test on the system. What is different 
in state targeting is how these elements are organized, 
and the fact that the person implementing the task (the 
player) submits rather than receives the quantum system. 

More explicitly, a state targeting task proceeds as fol- 
lows. At the outset, there is an unknown target state, 
drawn from a known set of states. The player submits a 
system, and only after doing so does she learn the iden- 
tity of the target state. At this point, the player must 
announce a state from the original set (not necessarily the 
target state), and the system is subjected to a pass/fail 
test for the announced state. Success is defined as an- 
nouncing the target state and subsequently passing the 
test for this state. 

The player can always make a random guess of the 
target state initially, and thereafter announce this state 
and be sure to pass the test for this state. This will lead 
to some finite probability of announcing the target state 
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while avoiding any risk of failing the final test. However, 
it turns out that any attempt to make the probability of 
announcing the target state greater than what is achieved 
with this trivial scheme results in a non-zero probability 
of failing the final test. This phenomena is analogous to 
the unavoidable disturbance that comes with information 
gain in state estimation. As one might expect, it too has 
interesting applications in quantum cryptography. 

The outline of the paper is as follows. In section II, we 
provide a simple cryptographic motivation for our study, 
namely, a weak coin flipping (WCF) protocol wherein one 
of the party's cheating strategies is an instance of state 
targeting. We also define the task of state targeting in 
greater detail than has been done in the introduction. In 
section III, we consider state targeting where the target 
state is drawn uniformly from a pair of pure states. We 
determine the maximum probability of success, and in- 
vestigate the rate at which the probability of failing the fi- 
nal test increases with the probability of success. Section 
IV generalizes the notion of state targeting by allowing 
for the possibility that the player simply declines from 
announcing a state. This allows the player to achieve 
some non-trivial degree of success without running any 
risk of failing the final test. (This is analogous to the 
fact that some information gain without disturbance be- 
comes possible in state estimation if one has the option 
to sometimes decline from resubmitting the system for 
testing.) This variant of the state targeting task is also 
shown to have a cryptographic motivation in terms of a 
weak coin flipping protocol. In section V, we optimize 
this variant in the case where the target state is drawn 
uniformly from a pair of pure states. 

In the second half of the paper, we consider state tar- 
geting for mixed states. This requires a careful consider- 
ation of what to use as a test for a mixed state, and so we 
begin in section VI by addressing this question. In section 

VII, we consider the success that can be achieved in state 
targeting between a pair of mixed states, and in section 

VIII, we examine the case where the player is allowed to 
sometimes decline from being tested. Section IX refines 
the analogy that exists between state targeting and state 
estimation by focusing on a variant of state estimation, 
which we call state spying, wherein the estimator must 
resubmit the system for testing. We consider the appli- 
cations of our results on state targeting and discuss some 
open problems in section IX. Finally, in section X, we 
consider the classical analogue of state targeting, which 
highlights the inherently quantum mechanical features of 
this task. 



II. MOTIVATION AND DEFINITION OF STATE 
TARGETING 

To emphasize the importance of state targeting in 
cryptography, and to motivate the sorts of problems that 
we shall address, it is useful to have an example of a 
protocol that makes use of this task. For this purpose, 



we introduce a very simple protocol for the two-party 
cryptographic primitive of weak coin flipping(WCF) 
Q. Here, two separated and mistrustful parties wish to 
engage in communication to generate a random bit, the 
value of which will fix a winner and a loser, in such a way 
that each party can be guaranteed that if they follow the 
honest protocol, the other party is limited in the extent 
to which they can bias the value of the bit in their favor. 

The simple weak coin flipping protocol we consider 
makes use of a pair of non-orthogonal pure states 
IV , o) ! |V'i)- If both parties are honest, it proceeds as fol- 
lows. 

Weak coin flipping protocol 1 

1. Alice chooses a bit b uniformly from {0,1}, prepares 
\ipb) and sends the system to Bob. 

2. Bob chooses a bit b' uniformly from {0,1} and an- 
nounces it to Alice (one can think of this as Bob's 
guess of the value of b) . 

3. Alice announces b to Bob 

4. Bob tests the system for being in the state \ipb)- 

If at step (4), the system fails Bob's test, then Alice 
is caught cheating. Otherwise, if b' = b then Bob 
wins, while if b' ^ b, then Alice wins. 

Alice may cheat by preparing the system in an arbi- 
trary state of her choosing at step (1), and making what- 
ever announcement she pleases at step (3). Bob may 
cheat at step (2) by performing a measurement upon the 
system, and using the outcome to inform his decision of 
what b' to announce. The extent to which Bob can cheat 
when Alice is honest depends on the extent to which he 
can correctly estimate which of a pair of non-orthogonal 
states applies to the system, in order to make the best 
possible guess of b and maximize his probability of mak- 
ing b' = b. The problem of state estimation has been 
extensively studied, and consequently the solution can 
be found in the literature [ToL lll| . On the other hand, 
the extent to which Alice can cheat when Bob is honest 
depends on the extent to which she can pass a test for 
the state opposite to the one Bob guessed, despite not 
knowing what Bob's guess will be when she submits the 
system. We can state this as follows: her target state 
is determined by Bob's announcement, which only oc- 
curs after she has submitted the system. This is a simple 
instance of state targeting. 

Note that Alice's announcement in step (3) of the pro- 
tocol determines what state Bob is to test for. Alice can 
only win the coin flip if she announces a bit b that is 
unequal to b' . However, if she announces b b' with- 
out having initially prepared |V , b); then she runs a risk of 
failing Bob's test. Of course, Alice may sometimes prefer 
to pass a test for the non-target state rather than failing 
the test for the target state. As such, she may not always 
ask Bob to test for the target state. 

The task faced by a dishonest Alice in our simple WCF 
protocol is just one instance of state targeting. More 
generally, a state targeting task is defined as follows: 
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(i) Alice submits a system to Bob. 

(ii) Alice learns the identity of the target state. 

(hi) Alice announces a state to Bob (not necessarily the 
target state). 

(iv) Bob performs a Pass/Fail test for the announced 
state. 

The possible outcomes are: 

(A) Alice announces the target state and passes Bob's 
test 

(B) Alice announces the target state and fails Bob's test 

(C) Alice announces a non-target state and passes 
Bob's test 

(D) Alice announces a non-target state and fails Bob's 
test 

"Success" in state targeting is to achieve outcome (A). 
Thus, we can quantify the degree of success by the prob- 
ability of this outcome. We call this probability Alice's 
control 2 We shall be interested in determining the max- 
imum control achievable in state targeting. 

There are several ways in which Alice might not suc- 
ceed. In cryptographic applications, it is reasonable to 
expect that failing one of Bob's tests has a greater cost 
than passing the test for a non-target state, since the 
former indicates that Alice has cheated. Thus, it is use- 
ful to consider the total probability of failing Bob's test, 
which is the sum of the probabilities for outcomes (B) 
and (D). We call this probability Alice's disturbance. It 
is sometimes useful for Alice to sacrifice some control 
to lower her disturbance. Thus, we shall be interested 
in determining the minimal disturbance for a given con- 
trol, which we refer to as the optimal control- disturbance 
trade-off. 



III. STATE TARGETING FOR TWO PURE 
STATES 

A. Maximum control 

Consider the example of state targeting that is pro- 
vided by our simple weak coin flipping protocol, namely, 
one wherein the target is selected uniformly from a pair 
of pure states, \4>o), I'M- If Alice simply wishes to max- 
imize her probability of announcing the target state and 
passing Bob's test, that is, if she is unconcerned about 



2 Note that in the case of two target states with equal prior proba- 
bility, our definition of this quantity coincides with the definition 
used in Ref. Q except that it is offset from the latter by a factor 
of 1/2. 




FIG. 1: A slice of the Bloch sphere, showing the two possi- 
ble target states, \ipo) and The state \ipAi) is the one 
that Alice must submit to achieve her maximal control. If 
she submits the state pH, then she can achieve some non- 
trivial control at the cost of some disturbance by steering to 
a particular convex decomposition of the state prior to her 
announcement. The pair of states \(f>), \4>') indicate the ele- 
ments of a convex decomposition that Alice might use where 
the target state is |i/'o}. In general the optimal state to submit 
in order to minimize her disturbance for a given control lies 
between pH and \i/jm). 



the relative probabilities of outcomes (B),(C) and (D), 
then she should always announce the target state. Her 
most general strategy at step (i) is to prepare the system 
in a (possibly mixed) state p. In this case, Alice's control 
is 

c = \{Mp\^) + \{^iWi)- (i) 

Noting that this can be rewritten as ^Tr^d^o) (-00 1 + 
l^i) (V'i I)j if i s clear that the maximum control is simply 
the maximum eigenvalue of | -0o ) ("00 1 + an( i is 

achieved by choosing p to be the associated eigenvector. 
Explicitly, the maximum control is 

C max = maxC= i(l + |(Vo|^i)l) (2) 
p 2 

and the state that achieves it is 

\ip M )=M(\ip ) + \ipi)), (3) 

where Af is a normalization factor, and the phases have 
been chosen so that (t/'oIV'i) is real. 

Since the Hilbert space spanned by any pair of pure 
states is two-dimensional, it can be represented using the 
Bloch sphere picture. Within this picture, \iPm) is repre- 
sented by the point that lies halfway between the points 
representing \ipo) and on the geodesic that connects 
them, as indicated in Fig. ^ 



4 



B. The control-disturbance trade-off 

By achieving her maximum control, Alice runs a risk of 
failing Bob's test. Since she always announces the target 
state in this case, outcomes (C) and (D) never occur and 
her probability of failing Bob's test (her disturbance) is 
simply the difference between 1 and her maximum con- 
trol, that is, l(V'olV'i)l)- If, on the other hand, Alice 
exerts her trivial control of 1/2 by preparing |^o) or 
with equal probability and then announcing this state re- 
gardless of the identity of the target state, she creates no 
disturbance. We can imagine, however, that situations 
may arise wherein Alice decides to achieve some non- 
trivial but non-maximal control. It is useful therefore 
to determine the minimal disturbance for every achiev- 
able degree of control. Since we find that this function is 
monotonically increasing, it also specifies the maximum 
control for a given disturbance. 

We begin by making the observation that a second 
strategy for Alice which achieves the trivial control with 
no disturbance is for her to couple the system she sends 
to Bob with an ancilla that she keeps, thereby preparing 
the entangled state 

-L(|0)hM + |l)|Vi» . (4) 

When it comes time to announce a state to Bob, she 
simply measures the ancilla in the |0), |1) basis, registers 
the bit value b of the outcome, and announces \ipb)- 

In this situation the reduced density operator for the 
submitted system is ph = ^IV'oXV'ol + oIV'iXV'iIj which 
is represented on the Bloch sphere by the point which lies 
halfway along the line joining the points corresponding 
to j'i/'o) and - this is depicted in Fig.Q] 

Alice can now use the following trick to increase her 
control beyond the minimum value. Suppose Bob an- 
nounces that the target state is |"0o)- Alice then imple- 
ments a measurement on her ancilla of some basis dis- 
tinct from the |0), |1) basis. This collapses the state of 
the submitted system to \<j>) with some probability q and 
to \4>') with probability (1 — q). An example is depicted 
in Fig. 1. We assume that of the two states, \cf>) has the 
greater overlap with \ipo) (as is the case in the figure), so 
that Alice announces \tjj ) upon obtaining the outcome 
associated with \(f>), and she announces l^i) upon ob- 
taining the outcome associated with | </>'). If the target 
state is \ipi), she exerts a similar strategy, collapsing the 
state of the submitted system to a different pair of states, 
\X) or |x'), with probabilities p and 1—p respectively. 3 



3 The possibility of influencing which of several convex decompo- 
sitions describe the updating of the state of a remote system by 
choosing which measurement to perform on a system with w hich 
it is entangled is the key element of the EPR argument |12| . 
Schrodinger de scri bed this phenomena as steering the state of a 
remote system 1 1 .'jj . We adopt this term, but are careful to avoid 



By this strategy, Alice achieves a control of 

C=^l(^o>| 2 + ^l(xl^i)| 2 . (5) 

Her disturbance, which is her total probability of failing 
Bob's test, is 

D = i[ g (l-|(0|^ o )| 2 ) + (l-g)(l-|(0'l^i)| 2 ] 

+ ^b(i-l(xl^i)l 2 ) + (i-p)(i-|(x'l^o)l 2 ] (6) 

One might worry that of all the convex decompositions 
of ph, only some can be realized by performing a mea- 
surement on the ancilla. If this were the case, then this 
subset of convex decompositions would have to be char- 
acterized before we could proceed with the optimization. 
Howe ver, this is not a concern, because as is shown in 
Refs. |l3j and [hi (and generalized to non-extremal de- 
compositions in |f|), every convex decompositions of a 
mixed state can be achieved by some measurement on 
the ancilla. Thus, we can vary over all convex decompo- 
sitions with the assurance that there is a measurement 
that will achieve it. Assuming \ipo) and are non- 
orthogonal, ph lies off the centre of the Bloch sphere, 
and consequently \4>) and \(f>') (which define the convex 
decomposition of pn) can be chosen such that q > 1/2; 
this follows from the fact that pn is geometrically closer 
to |0) than to \cf>') in the Bloch sphere. Similarly, Alice 
can ensure that p > 1/2. Despite the fact that Alice has 
a non-unit probability of passing Bob's test, her overall 
probability of success can increase. 

We do not expect that pn will correspond to the opti- 
mal p for every value of the control that Alice may wish to 
achieve. Indeed, we already know that in order to achieve 
her maximum control, she must submit a different state, 
indicated by \iPm) in Fig. ^ Thus we expect the opti- 
mal p to be an interpolation between pn and \tJjm) as we 
increase C from 1/2 to C" nax . So, we must perform two 
optimizations: an optimization over the state p of the 
submitted system, and an optimization over the convex 
decomposition of p she should realize prior to announcing 
to Bob which state he should test for. 

It is not difficult to show that the optimal p has a Bloch 
vector that bisects the Bloch vectors representing 
and and that the optimal convex decomposition to 
realize when \ipi) is the target state is simply the mirror 
image in the Bloch sphere of the optimal convex decom- 
position when l^o) is the target state, so that q = p. 
These simplifications leave us with a two parameter op- 
timization problem: the one parameter corresponding to 
the length r of the Bloch vector representing p, the other 
parameter corresponding to the angle between the Bloch 
vectors representing |?/>o) and \<p). Although, we have not 



saying that the state is steered, since what one can steer between 
are different convex decompositions of the state. 
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FIG. 2: The control disturbance tradeoff for two pure states, 
with |(?/>o|V'i)| 2 = 1/2. Curve (a) is for the case where Alice 
does not have the option to decline from being tested, consid- 
ered in section UlI Bl whereas curve (b) is for the case where 
she does, considered in section IV Bl For the former, the dis- 
turbance is non-zero for every control above 1/2, while for 
the latter it is only non-zero after the point indicated in the 
diagram. 



been able to perform this optimization analytically for 
very value of |(^>q|^>i)|. The curve (a) in Fig. |21 depicts 
the optimal tradeoff for | (^ol^i) | 2 = 1/2. 



IV. MOTIVATION AND DEFINITION OF 
DISTURBANCE-FREE STATE TARGETING 

In the context of the WCF protocol presented earlier, 
it may sometimes be the case that the consequences for 
Alice if she is caught cheating are sufficiently dire that 
she wishes to avoid this outcome at all costs. The ques- 
tion then becomes whether this is enough to guarantee 
that she follow the honest protocol. For the case of two 
non-orthogonal target states, if Alice submits some state 
distinct from one of these possibilities, then regardless 
of what she announces, she has a non-zero probability 
of failing Bob's test. The only way to be certain to 
pass Bob's test is to submit one of these states and to 
announce the same state, that is, to follow the honest 
protocol and achieve the trivial control of 1/2. This is 
reflected in curve (a) of Fig. © by the fact that for ev- 
ery value of control greater than 1/2 the disturbance is 
non-zero. 

Nonetheless, there are useful versions of the task of 
state targeting wherein Alice has the option of declining 
from announcing a state to Bob, and in such cases, Al- 
ice can achieve greater than the trivial control without 
incurring any disturbance. 

We again introduce a simple WCF protocol as moti- 



vation. This differs from the previous one in that both 
Alice and Bob are tested for cheating, which results 
in a protocol that offers fewer cheating possibilities for 
Bob, but more for Alice. If both parties are honest, the 
protocol proceeds as follows. 

Weak coin flipping protocol 2 

1. Alice chooses a bit b uniformly from {0,1}, prepares 
\ipb) and sends the system to Bob. 

2. Bob chooses a bit b' uniformly from 0,1 and an- 
nounces it to Alice (one can think of this as Bob's 
guess of which state Alice submitted) . 

3. Alice announces b to Bob 
If b' = b, then 

4. Bob returns the system to Alice, and Alice tests 
the system for being in the state \ipb}- 

Else, if b' ^ b, then 

4. Bob tests the system for being in the state \ipb}- 

If at step (4) the system fails Alice's(Bob's) test, 
then Bob(Alicc) is caught cheating. Otherwise, if 
b' = b then Bob wins, while if b' ^ b, then Alice 
wins. 

As before, Alice may cheat by preparing the system in 
an arbitrary state of her choosing, and making whatever 
announcement she pleases. The difference is that if she 
announces b' = b, then she is not tested by Bob. 

This suggests a more general type of state targeting 
task, which differs from the one outlined in section ^ 
insofar as step (iii) is replaced by: 

(in') Alice has the option of either (a) announcing a state 
to Bob (not necessarily the target state), or (b) 
declining to announce a state to Bob. 

There is also an additional possible outcome relative to 
the version from the last section, namely: 

(E) Alice declines to announce a state to Bob. 

Because of this additional outcome, Alice can make 
her disturbance strictly zero while still achieving a non- 
trivial control. We call this disturbance-free state tar- 
geting. The control that Alice achieves by implementing 
her best disturbance-free state targeting is still defined 
as her probability of achieving outcome (A) . We call this 
her disturbance-free control, and denote it by Cdf. (An 
analogous quantity is defined in Ref. Q , where it is called 
Alice's threshold for cheat-sensitivity.) 

The possibility of disturbance-free state targeting is 
analogous to something that occurs in unambiguous dis- 
crimination of pure states [l5j. (The latter is a procedure 
which either discriminates the states without any prob- 
ability of error, or else simply returns the result "incon- 
clusive".) If the inconclusive outcome is not obtained, 
then the pure state with which the system was prepared 
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is known with certainty, and can be re-prepared, so that 
a test for the initial state can be passed with certainty. 
If the inconclusive result is obtained, then the estima- 
tor declines from having the system tested. Thus, the 
existence of an inconclusive outcome allows for the pos- 
sibility of information gain without disturbance. Analo- 
gously, the option to decline from being tested allows for 
non-trivial control without disturbance. 
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DISTURBANCE-FREE STATE TARGETING 
FOR TWO PURE STATES 

A. Maximum disturbance-free control 



We now demonstrate how disturbance-free state tar- 
geting is achieved in the case where the target state is 
chosen uniformly from two non-orthogonal pure states. 
The technique is similar to the one used to minimize the 
disturbance for a given control. Alice initially couples 
the submitted system to an ancilla (which she keeps) so 
that the state of the pair is entangled. After learning the 
identity of the target state, she measures her ancilla in 
such a way that the state of the submitted system is up- 
dated according to a convex decomposition that contains 
the target state. If it happens to collapse to the target 
state, then she announces the target state, and is certain 
to pass Bob's test. If it collapses to another state, then 
she simply declines to announce a state to Bob. 

The fact that such a scheme can achieve a control 
greater than 1/2 can be seen by considering Fig. Q. If 
the state p that Alice submits falls between pn and the 
completely mixed state (the centre of the Bloch sphere), 
and she steers to a two-element convex decomposition 
containing the target state, then because p is necessar- 
ily geometrically closer to the target state than to the 
other element of the decomposition, and because greater 
geometric proximity represents a greater probability of 
collapsing to that element it follows that the proba- 
bility of announcing the target state is necessarily greater 
than 1/2. 

We now proceed to find the maximum probability of 
disturbance-free state targeting. We must vary over both 
the convex decompositions for a fixed submitted state, 
and over the submitted states. 

In the first optimization, we seek to find the largest 
probability with which the target state appears in a con- 
vex decomposition of the submitted state. A corollary 



we prove in section IjVIIIII establishes that the maximum 
probability of collapsing the state p to the state \ip) is 
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Given that the target state is equally likely to be |Vo) or 
\ipi), the disturbance-free control for a submitted state p 
is 
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FIG. 3: A section of the Bloch sphere showing the state p° p 
that yields the largest disturbance-free control when the pos- 
sible target states are |Vo) and |^>i). 



We can now consider the optimization over p. Since 
there is clearly no advantage to preparing a p outside 
of the subspacc spanned by \ipg) and \ipi) , the problem 
can be entirely formulated in a two-dimensional Hilbcrt 
space, so that we may use the Bloch sphere representa- 
tion of states. The optimization is done in Appendix lAl 
The maximum disturbance-free control is found to be 



Cmax 
df 



max Cdf 
p 
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(9) 
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The strategy that achieves this control requires Alice 
to prepare a mixed state of the form 



P 

where 



opt 



2 
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(|Vo> (Vol + |Vi)(Vi|), (10) 



a = 1 



KV0IV1 



(i - Vi-KVohMI 2 ) • (ii) 



It is easy to see that the maximum disturbance-free 
control, Eq. is less than the maximum control, 

Eq. J2J), for any pair of states. Thus, to avoid creating a 
disturbance, Alice must pay a price in control. 

In terms of the Bloch sphere picture, p° pt has a par- 
ticularly simple geometric relation to |Vo) an d |Vi)> as i s 
depicted in Fig. [3] Note that the states \Xo) and \X\) 
are orthogonal and symmetric about |Vo) and \tpi). If 
the target state is |Vo)j then Alice steers to the decom- 
position of p opt containing \tp ) and |A ). 



B. The control-disturbance trade-off for state 
targeting with an option to decline 

It is interesting to determine the minimal disturbance 
for a given control when there is an option to decline from 
announcing a state. In this case, the disturbance will be 
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non-zero only for controls greater than the disturbance- 
free control. However, the disturbance for the maximal 
control is the same, since to achieve her maximal con- 
trol, Alice must always announce the target state, and 
consequently never exercises her option to decline from 
announcing a state. 

We consider this tradeoff in the simple case of two pure 
states. Suppose that Alice has submitted some p and 
now learns that the target state is |"0o) - As described in 
section llll Bl she can make a measurement on the ancilla 
which collapses the submitted system to cither the state 
|0) (with probability q) or to state \<p') (with probability 
1 — q). As before, if she collapses to the state |</>) then she 
announces the state IV'o)- Unlike before however, if she 
collapses p to \<fi'} then she declines to announce a state 
to Bob rather than announcing \ ipi). A similar strategy is 
adopted if the target state is IV'i)- This scenario does not 
affect the expression for the control that Alice achieves, 
it is still given by (jSJ). However her disturbance is now 
given by 

^=^(l-|(^o>| 2 ) + ^(l-|(xl^i>| 2 ) (12) 

Once again the problem of minimizing Alice's distur- 
bance for a given control can be simplified to an opti- 
mization over only two parameters. The solutions to this 
optimization problem can be found analytically. Specif- 
ically, we obtain the optimal control and disturbance as 
parametric equations in a parameter p which runs from 
to 9, where 9 = | (ipo \ by definition. Explicitly: 



jjopt 



1 cos p — sin(# — p) 

2 1 + sin(6» - p) 

1 1 — cos p 

2 1 + sin(0 - p) 



(13) 
(14) 



The length r of the Bloch vector corresponding to the 
optimal p that Alice should submit for a given control is 



1 — sin(6> — p) 
cos(9 — p) 



(15) 



Curve (b) of Fig. J3J) is a plot of this optimal tradeoff for 
9 = tt/4. 



VI. TESTING FOR A MIXED STATE 

We have thus far examined state targeting under the 
assumption that the possible target states are pure. A 
useful and powerful generalization of state targeting oc- 
curs if we admit the possibility of mixed target states. 
Recall that the task of state targeting requires Bob to test 
the submitted system for being in the state announced 
by Alice. Thus, we must begin by discussing the possible 
ways in which one can test for a mixed state. Because 
greater difficulty in passing a test typically yields greater 



security for the protocol making use of it, we seek to find 
the tests that are most difficult to pass. 

For convenience, we call the tester Bob and the one 
being tested Alice. The only kind of measurement on 
the submitted system alone that is always passed when 
the system is in the state a is one that is associated with 
a projector onto a subspace that is greater than or equal 
to the support of a. The most difficult such measurement 
to pass is the one associated with the projector onto the 
support of a . We call this the support test for a. Unfor- 
tunately, there are many other mixed states which always 
yield a positive outcome for this test, namely those hav- 
ing the same support as a. Thus, this test is relatively 
easy to pass. 

Another interesting test is one that makes use of a par- 
ticular convex decomposition of a, that is, a set {pk, l^fc)} 
such that 'YlikPk\''Pk){' t Pk\ = o~. The idea is that if Alice 
prepared the system in a state by drawing it from the set 
{iV'fc)} according to the distribution pk, then from Bob's 
perspective, she has submitted the state a. If Alice does 
not implement such a preparation, then it is possible for 
Bob to sometimes detect this fact; he simply demands 
that Alice announce the value of k to him, and he then 
tests the system for being in the state \tpk)- We call this 
a convex decomposition test for a. This test is better 
than the support test, because if Alice initially prepares 
a mixed state that merely has the same support as a, 
this does not guarantee that she can pass a convex de- 
composition test with certainty. Nonetheless, it is still 
a weak test since there any mixed states besides a that 
can pass the test with certainly, namely, any state that 
is a convex sum of the \ipkj- The problem is that the test 
cannot verify anything about the probability distribution 
from which the state was drawn. Convex decomposition 
tests arise often in the design of cryptographic protocols 
[llSBIl, although they are not typically identified as 
tests for a particular mixed state. 

The best way of testing whether a system is described 
by a state a is to test whether a larger system, of which 
the first is a subsystem, is in a purification of a. Suppose 
Alice initially submits a system B to Bob. When it comes 
time to test this system for being in a, Alice is required 
to submit a second system, called the message system M, 
and Bob measures the pair MB for being in a particular 
purification of a, that is, for being in a state Y$>) such 
that TrM(| v I / )( x I , |) = cr (there are many purifications of a 
mixed state, but all these yield equivalent tests). This is 
better than either the support or convex decomposition 
tests. First of all, unlike the latter tests, Alice can only 
pass this test with certainty if the state of the submitted 
system was a. More importantly, it can be shown that for 
every convex decomposition test, there is a purification 
test that is equally or more difficult to pass. This is 
proven in appendix IbI 

Notwithstanding this fact, in the context of state tar- 
geting between a pair of mixed states, it is often pos- 
sible to find a pair of convex decomposition tests that 
yield a maximum control as low as the maximum con- 
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trol for a pair of purification tests. An example is offered 
by the coin flipping protocols proposed in Ref. [|| and 
in Ref. where Alice's optimal cheating strategies are 
state targeting procedures that achieve the same control. 
Because of the practical difficulty of generating, preserv- 
ing and measuring entangled states, it is likely that, other 
things being equal, a pair of convex decomposition tests 
is preferable to a pair of purification tests for use in a 
cryptographic protocol. However, it is an open question 
whether for every pair of purification tests there is a pair 
of convex decomposition tests that yield the same max- 
imum control. In any event, it is clear that convex de- 
composition tests cannot do better than purification tests 
and therefore for the rest of this paper we focus on the 
latter. 



VII. STATE TARGETING FOR TWO MIXED 
STATES 

We begin by motivating the generalization of state tar- 
geting to mixed states by describing another improve- 
ment on our simple weak coin flipping protocol. The 
protocol is defined in terms of a pair of states \*f?o) and 
l^i) on a bi-partite system, where the parts are denoted 
by M and B. If both parties are honest, it proceeds as 
follows. 

Weak coin flipping protocol 3 

1. Alice chooses a bit b uniformly from {0,1}, prepares 
the system MB in the state and sends B to 
Bob. 

2. Bob chooses a bit b' uniformly from {0,1} and an- 
nounces it to Alice (one can think of this as Bob's 
guess of b). 

3. Alice announces b and sends the system M to Bob. 

4. Bob tests the system MB for being in the state 

If at step (4) the system MB fails Bob's test, then 
Alice is caught cheating. Otherwise, if b' = b then 
Bob wins, while if b' ^ b, then Alice wins. 

Assuming the states |\l>o) and j^i) are entangled over 
Tt M ®H B , their reduced density operators on B, denoted 
<7o and <Ti, are mixed. |^b) is a purification of <7&. Thus, 
Bob's test at step (4) is a purification test for a b - It 
should now be clear that Alice's task when cheating is an 
instance of state targeting with two mixed target states, 
since the state ab that Alice would like to pass a test 
for is determined by Bob's announcement, which occurs 
after she has submitted system B. 

Note that if l^o) and l^i) are taken to be product 
states, this protocol reduces to WCF protocol 1. Mak- 
ing use of entangled |^o) and (equivalently, mixed 
<7o and or ) provides an improvement over WCF pro- 
tocol 1 insofar as it provides better simultaneous secu- 
rity against Alice and Bob. This is shown explicitly in 



Ref. 0. Briefly, it follows from the fact that the secu- 
rity against Alice is quantified by the fidelity between 
do and <7i (as we shall show), while the securit y ag ainst 
Bob is quantified by the trace distance (see Ref. jicllll^ . 
and the fact that the greatest fidelity for a given trace 
distance is achieved when ero and <j\ are mixed |Tsj . 

The only aspect of the definition of state targeting (sec- 
tion [nj that must be changed to accommodate the pos- 
sibility of purification tests for mixed states is that at 
step (hi), when Alice announces a state to Bob, she must 
also supply him with a message system, so that he may 
measure whether the submitted and message systems to- 
gether are in a purification of the state announced. 

In this section we explain the most general strategy 
which Alice can employ in order to obtain non-trivial 
control in state targeting between two mixed states. 

In order to increase her control, it may be to Alice's 
advantage to make random choices. As is well known 
however 0, Alice loses nothing by making these choices 
at a quantum level - that is, by entangling the sys- 
tem MB with an ancillary system A which she retains. 
In general therefore, she will be preparing the system 
AMB in an entangled state \Q AMB ). The reduced den- 
sity on the system B which is submitted to Bob is then 
p = Tr A M\<d AMB )(<d AMB \- Thus, in this case Alice has 
submitted p to Bob. 

Prior to Alice announcing to Bob which state he should 
test for, she may implement a transformation on the sys- 
tems AM that remain in her possession (this includes 
the possibility of a measurement, since Alice loses noth- 
ing by keeping the outcome at the quantum level). The 
most general transformation is described by a completely 
positive trace-preserving linear map. However, by Neu- 
mark's theorem |l6j . an equivalent transformation can 
always be achieved using a unitary map and a larger an- 
cilla. Thus, without loss of generality, we can assume 
that Alice implements a unitary transformation U b AM , 
where the subscript b — 0, 1 indicates that the operation 
which Alice performs will generally depend on which of 
the states, ero or a\, is the target state. 

We denote by P(a b \p, U b AM ) the probability that Alice 
passes a test for crj,, given that she submitted p to Bob 
and employs the interaction U b AM prior to sending M 
to him. Given our description of Alice's most general 
strategy, we have that 

P(a b \p,U b AM ) = |<e AMB |t/ 6 AM ® IW)| 2 (16) 

Alice's maximum control is given by 

i 1 

C* max = max - V maxP(cr b |p, U£ M ) (17) 

Thus, finding the maximum control that Alice can 
achieve requires two optimizations: (i) For a fixed sub- 
mitted p, an optimization over the transformation she 
implements on the systems remaining in her possession 
after she has learnt the identity of the target state, (ii) 
An optimization over the initial entangled state |6- 4A/B ) 
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that she should prepare, equivalcntly, over the state p 
that she should submit to Bob. 



A. Optimal state unveiling procedure 

In this section we will assume that the state p which 
Alice has submitted is fixed, as is the target state, er, 
that defines the purification test on MB to which her 
system and the message system will be subjected. We 
are therefore performing an optimization of the form (i) 
above. 

When Alice succeeds at passing a test for a state er, 
we say that she has unveiled a. This terminology is sug- 
gested by the application of state targeting to bit com- 
mitment. We wish to determine the maximum probabil- 
ity with which Alice can pass a test for a, i.e. unveil er, 
given that she has submitted p. 

By the definition of a purification test, when Alice 
wishes to unveil er, she must send a message system M 
to Bob, who will then test whether the composite MB is 
in a particular purification \<ir MB ) of er. As it turns out, 
the particular purification of er that is used in the test 
does not affect the difficulty of the task. 

Suppose for the moment that Alice does not use an 
ancilla, and instead simply prepares MB in the pure state 
|$ A/B ) and implements a unitary U M on M alone. In 
this case, the optimization problem reduces to finding the 
maximum probability with which a purification on MB 
of p can pass the test for being a purification on MB of 
er, and the solution is given by Uhlmann's theorem |l7j . 
which may be stated as follows: 

max|($ MB |J7 M ®/ s |* MB )| 2 = F(p,a) 2 , (18) 

where F(p, a) = Tr\y^p^/a\ is the fidelity between a and 
P- 

Of course, there is nothing preventing Alice from mak- 
ing use of an ancilla, so one might naively expect her 
to be able to do better than this. However, it turns out 
that the use of an ancilla does not in fact give Alice more 
targeting power. This fact follows from a generalization 
of Uhlmann's theorem; the need for this theorem 4 (and 
an initial proof of it) was pointed out to us by Claus 
Doscher: 
Theorem 1: 

max | (e AMB \U AM <g> I B |* MB ) | 2 = F(p, a) 2 , (19) 



4 In Ref. Q, Alice's maximum control for state targeting in the 
context of a bit commitment protocol was derived without suffi- 
cient generality since the possibility of making use of an ancillary 
systems A was not considered. The results of that paper remain 
unaffected, however, since this possibility does not increase the 
control that Alice can achieve. 



where JJ AM is a unitary map on AM, I B is the iden- 
tity map on B, p = Tr AM \e AMB )(e AMB \ and a = 
Tr M |* A/B )(* A/B |. 

Proof: To see that the left hand side (LHS) of Eq. O 
must be greater than or equal to F(p, a) 2 , note that 

LHS = m&xJ2\(® AMB \U AM ® I B \ IXfe) ® l* MB » I 2 
> mait\{e AMB \U AM ® I B \ \ X A ) <8> |* MB >) | 2 

U AM 

= F(p,a) 2 

In the first step, we have simply introduced an arbitrary 
resolution of identity for A in terms of the basis {|Xfc)}- 
The second step follows from the fact that all the terms 
in the sum over k are positive (here, \x A ) is an arbi- 
trary element of the basis {|Xfe}})- Noting that |0- 4A/B ) 
and \x A ) ® \^ MB ) are purifications of p and a on AMB, 
Uhlmann's theorem, Eq. (|18|) . dictates that the optimiza- 
tion yields F(p, a) 2 . 

To see that the LHS of Eq. (|19|) must be less than 
or equal to F(p 7 a) 2 , we note that if the reduced den- 
sity operator of (U AMi <Z> I B )\Q AMB ) over MB is denoted 
by W MB , then LHS = max v am (^ mb \W mb \^ mb ) = 
maxjjAM F(\^ MB )(^ MB \,W MB ). However for any U AM , 
TtmW mb = p, and since the fidelity is non-decreasing 
under the partial trace of its arguments |l8l| , we have 

F(|* MB )(* i/B |,IU J,/B ) < J F(Tr JU |1' J,/B )(* MB |,Tr A/ IU J,/B ) 
= F(a,p). 

m 

Theorem 1 tells us that the maximum probability of 
unveiling a given that p was submitted is F(o,p) 2 . We 
see from this that it is appropriate to call F(a, p) 2 the 
'transition probability' between a and p, as Uhlmann has 
done. 



B. Optimal state to submit 

The results of the previous subsection were limited to 
the case of a fixed submitted p. To determine Alice's 
maximum control we need to optimize over p, which is 
an optimization of form (ii) above. 

Combining Eqs. and fTSjl with theorem 1, we find 
that the maximum control given a target state drawn 
uniformly from {<7o, eri} is given by 

C max - m^^F^pf + ^FiaupA. 

The result of the optimization over p is 

C max = |(l + JVo,<ri)). (20) 

The proof of this was first presented in Ref. |j| (lemma 
2) and was discovered independently in Ref. [ijj. It is 
reproduced in Appendix IU1 
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The optimal strategy, i.e. the one that attains Q20[l. 
requires Alice to initially submit a mixed state of the 
form 

opt _ °o + g i + V°o u + V^iU^V^a ( r 
9 2(l + *> ,<r x )) ' (2L) 

where 

u = iv^rv^r'vW^r- ( 22 ) 

Again, the proof is relegated to Appendix It is easy 
to verify that these results reduce to those presented in 
section All Al for pure states. 

It is interesting to note that the maximum probability 
of correctly estimating which of two mixed states applies 
to a system is given by (1+D(a , cr 1 ))/2, where D denotes 
the trace distance. We have just shown that the maxi- 
mum control in state targeting between two mixed states 
is given by (1 + F(<jq, <ti))/2. Although the trace dis- 
tance and fidelity are known to be closely related math- 
ematical measures of distinguishability for mixed states, 
the former is generally presumed to be much better op- 
erationally motivated because of its connection to state 
estimation. Our result on maximum control can be in- 
terpreted as providing a simple operational definition of 
the fidelity. 



VIII. DISTURBANCE-FREE STATE 
TARGETING FOR TWO MIXED STATES 

Consider a fourth and final weak coin flipping protocol, 
which is to WCF protocol 3 as WCF protocol 2 is to WCF 
protocol 1. 

Weak coin flipping protocol 4 

1. Alice chooses a bit b uniformly from {0,1}, prepares 
the system MB in the state l^i,) and sends B to 
Bob. 

2. Bob chooses a bit b' uniformly from {0,1} and an- 
nounces it to Alice (one can think of this as Bob's 
guess of b). 

3. Alice announces b and sends the system M to Bob. 
If b 1 = 6, then 

4. Bob returns the system B to Alice, and Alice tests 
the system MB for being in the state \^b)- 

Else if b' ^ b, then 
4. Bob tests the system MB for being in the state 

1*6). 

If at step (4) the system fails Alice's(Bob's) test, 
then Bob(Alice) is caught cheating. Otherwise, if 
b' = b then Bob wins, while if b' ^ b, then Alice 
wins. 



The difference from WCF protocol 3 is that when Bob 
guesses b correctly, he must return system B to Alice. If 
Bob has gained information about the state of the sys- 
tem, then he has necessarily caused a disturbance to the 
state, and Alice has a probability of detecting this. Thus, 
the protocol offers greater security against Bob at the 
expense of security against Alice (since she is tested less 
frequently) . 

Alice's cheating strategy in this case involves state tar- 
geting between mixed states, as in WCF protocol 3, how- 
ever unlike that protocol, if she announces a b that is 
equal to b' , she is not tested by Bob. Thus, this is an 
instance of state targeting between mixed states wherein 
there is an option to decline being tested. The state 
targeting task is the same as the one described in sec- 
tion ]W\ except that at step (iii'), if Alice announces a 
state to Bob, then she must also supply him with a mes- 
sage system, so that he may implement a purification 
test. The possibility of declining from being tested im- 
plies that Alice can achieve a non-trivial control while 
not running any risk of failing Bob's test. In other words, 
her disturbance-free control can be greater than the triv- 
ial control. In this section, we investigate the maximum 
disturbance- free control that can be achieved in state tar- 
geting between two mixed states. 

Alice's most general strategy for this sort of state tar- 
geting involves introducing an ancilla A, so that AMB is 
in an entangled state \Q AMB ) with reduced density op- 
erator p on B. At the time of announcement, Alice must 
perform a measurement on the system AM which cither 
collapses the B system to the target state erf, (and the 
MB system to a purification of <ib) in which case she can 
pass the test for Ob with certainty, or she collapses the 
B system to another state, in which case she invokes her 
option to not be tested by Bob. 

When Alice happens to collapse the state of Bob's sys- 
tem to er, we say that she has generated the state a. The 
distinction between state unveiling and state generation 
is critical to understanding the difference between achiev- 
ing state targeting and achieving disturbance-free state 
targeting. A state has been unveiled whenever a test for 
the state has been passed. A state has been generated 
only if a test for the state would always be passed. 

We begin by looking at Alice's ability to generate a 
given a fixed submitted p. We then consider variations 
over p. 



A. Optimal state generation procedure 

We assume that Alice has submitted a fixed state p and 
is trying to generate the state a. As discussed in section 
IIVI it was proven in Ref. [T3 | that by appropriate mea- 
surements on AM, Alice can update her description of 
B according to any extremal convex decomposition of p, 
that is, any convex decomposition whose elements are all 
pure states. This also holds true for non-extremal convex 
decompositions (whose elements may be mixed states) as 
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is shown in Ref. Thus, Alice's maximum probabil- 
ity of generating a is given by the maximum probability 
with which the state a can appear in a convex decom- 
position of p. The latter is fixed by the following result, 
communicated to us by Michael Nielsen: 

Theorem 2: The maximum probability with which a 
state a can appear in a convex decomposition of a state 
p is 



(23) 



if the support of a belongs to the support of p, and zero 
otherwise. 

Proof: It is well known that if the support of a is not 
contained in the support of p then a does not appear in 
any convex decomposition of p [T3 |. If the support of a 
is so contained, then there exist decompositions of the 
form 



p = pa + (1 — p)x 



(24) 



where i is a density operator and < p < 1. We seek 
to determine the largest possible value of p; the key con- 
straint is that x be a valid density operator. Since it 
follows directly from Eq. (|24|l that x has trace 1, the 
constraint becomes simply that x be positive. Acting on 
the left and the right of Eq. f2*4^l with y/p^ 1 (where the 
inverse is taken over the support of p), we have 



i = pVp 1(T Vp + ( 1 ~p)Vp 1x Vp ■ 



(25) 



The constraint that x be positive implies that (1 — 
p)y/p~ x^fpT is positive, which in turn implies 
p^fpT 1 o^ffT 1 < I. This constrains all the eigenvalues 
of PyJ~p~ <jJ~p to be less than 1, which implies that 

P < l/-Mv / /^~ 1<7 v / ^ 1 ) w h ere M-%) denotes an eigen- 
value of X. The maximum achievable value of p is simply 
the smallest upper bound, which is the reciprocal of the 
largest eigenvalue l/X max (^/p~' 1 a > /p~ 1 ). Making use of 
the fact that A max (AB) = X max (BA), we obtain the de- 
sired result. ■ 

Corollary The maximum probability with which a 
pure state |V) can appear in a convex decomposition 
of a state p is 
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This follows from the fact that 



(26) 



A—Go" 1 |V) (VI) = A- ax (Vp" 1 IV) (VI X//T 1 ) 

= (vi p-'m, 

where the last equality is implied by the fact that 
^fp^ 1 IV) is an eigenvector of \ff> X IV) (VI \[P~ X 
with eigenvalue (V|p _1 |V) 5 an( l the fact that 
^ffT 1 |V) (VI \J~P~ 1 , being of rank 1, has only a sin- 
gle non-zero eigenvalue. 



Besides its obvious importance for state targeting, 
Theorem 2 is also an important result for the theory 
of entanglement transformation. It specifies the largest 
probability of transforming a purification of p into a pu- 
rification of a given access to only the purifying share of 
the bi-partite system. 



B. Optimal state to submit 

To compute the maximum disturbance-free control in 
state targeting between ao and ai , it follows from Theo- 
rem 2 that we need to evaluate 



1 



1 



1 



df 2 "7" V^ max (P~ 1(J o) ' A max ( / 9- 1 (Ti) 



(27) 



We have only been able to obtain bounds on this quantity, 
the most simple ones being: 



1 



1+ v/l-F^o.^i) 



< 1 



1 



£>(*(,, <7i), (28) 



where, as before, F{x,y) = Tr\^Jx^/y\ is the fidelity, and 
D(x, y) = ^Tr\x — y\ is the trace distance. We point out 
that CJf ax forms an operationally motivated measure of 
the distance between two mixed states. 

The lower bound is derived as follows. To generate ao 
or (Ti on demand, it is sufficient to generate purifications 
l^o) i l^i) °f a o and o\ on demand. We know that the 
latter can be done with the probability given by Eq. 
and the largest this probability can be made is for maxi- 
mally parallel purifications, which by Uhlmann's theorem 
satisfy | (*o|*i) | 2 = F(a 0l ax) 2 ■ Making this substitution 
yields the advertised lower bound of Eq. 

Note that the lower bound is saturated for pure Cto 
and <j\. A number of stronger results can be obtained 
if (To and oi are confined to a two-dimensional Hilbcrt 
space. For instance, in the special case of ao and a\ 
having equal purity, we find the lower bound of Eq. I|28|) 
is again saturated, and for <7o and o\ commuting, one 
can find a simple analytic expression for the maximum 
disturbance-free control. 

The upper bound is more subtle. Recall that our task 
is to find a state p and two convex decompositions of p, 
one involving ao and the other involving <j\ , 

p = p a + (1 -po)x 
= P\v\ + (1 -p\)x\, 

such that h{po + Pi) is maximized. We first note that 



Pb = 1 



D(j>, a b ) 



D(a b ,Xb) 

This follows from the observation that 

D(p,a b ) = ^Tr \(p b - l)a b + (1 - p b )x b \ 
= (1 - p b )D(a b ,x b ) 



(29) 
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Now, making use of the fact that D(ab, Xb) < 1, we find 
l(po+Pi) <l-^(D(p,a ) + D(p,a 1 )). (30) 

Finally, recognizing that the trace distance is a metric 
and thus satisfies D(a,b) + D(b,c) > D(a,c), we obtain 
our upper bound. This upper bound is sometimes satu- 
rated, for instance, when the two states are confined to 
a 2-d Hilbcrt space with one being pure and the other 
being the completely mixed state. 

IX. STATE SPYING 

To motivate our study of state targeting, we have in- 
troduced a variety of weak coin flipping protocols wherein 
Alice's cheating strategies are instances of state target- 
ing. Since it has not been our intention to provide a 
security analysis of any particular protocol, we have said 
little about Bob's optimal cheating strategics. Nonethe- 
less, in the protocols where there is quantum communi- 
cation from Bob to Alice (i.e. protocols 2 and 4), Bob's 
cheating strategies are instances of a task that is comple- 
mentary in many respects to the task of state targeting. 
We shall call this task state spying. 

We begin by contrasting state spying to state discrim- 
ination. The latter is what occurs in the WCF protocols 
where Bob is not tested. Here, a cheating Bob is faced 
with the following situation. Alice has submitted a sys- 
tem prepared in one of a pair of states, and Bob seeks 
to guess which state this was. Thus, he seeks to maxi- 
mize his information gain, specifically, his probability of 
correctly estimating the state that Alice submitted. On 
the other hand, in the protocols where Bob is required to 
return a quantum system to Alice whenever he guesses 
correctly, he is faced with a different task: to gain infor- 
mation while avoiding, as best as possible, having Alice 
detect this fact. Specifically, Bob seeks to maximize his 
probability of correctly estimating the state and passing 
Alice's test. We call this task state spying because the 
job of a spy is not simply to gain information, but to do 
so without the adversary being aware of this fact. 

The simplest version of the state spying task proceeds 
as follows: 

(i) Alice submits a system in some state, called the 
prepared state, to Bob. 

(ii) Bob implements a measurement on the sys- 
tem(possibly trivial) and forms an estimate of the 
prepared state, called the guessed state. 

(iii) Bob announces the guessed state. 

(iv) Bob returns the system to Alice, and Alice performs 
a Pass/Fail test for the prepared state. 

The possible outcomes are: 

(A) Bob announces the prepared state and passes Al- 
ice's test 



(B) Bob announces the prepared state and fails Alice's 
test 

(C) Bob announces a non-prepared state and passes Al- 
ice's test 

(D) Bob announces a non-prepared state and fails Al- 
ice's test 

In state spying, "success" is to achieve outcome (A). Pur- 
suing the spying metaphor, we call the probability of 
achieving outcome (A) the intelligence. Another proba- 
bility that is of interest is the probability of failing Alice's 
test, i.e. the sum of the probabilities of outcomes (B) or 
(D). We call this the disturbance. 

In the introduction, we provided a brief description 
of how state spying is similar to state targeting. The 
analogy is clearer if one compares the above definition 
of state spying with the definition of state targeting pro- 
vided in section |B] Moreover, just as it is useful for 
security analyses of two-party protocols to determine the 
maximal control, the maximum disturbance-free control 
and the optimal control-disturbance trade-off, so too is 
it useful to determine the maximum intelligence, the 
maximum disturbance-free intelligence, and the optimal 
intelligence-disturbance trade-off. 

For pure states, the maximum probability of success 
in disturbance-free state spying is equal to the maximum 
probability of success in error-free state discrimination, 
since someone who has achieved success in an error-free 
discrimination procedure knows the identity of the pre- 
pared state, and consequently can always re-prepare the 
state and pass a test for it with certainty. 

Mixed states can be incorporated into the notion of 
state spying in exactly the same manner in which they 
are incorporated into state targeting. As we have shown, 
a test for a purification of a mixed state is the most diffi- 
cult test to pass, and consequently is the most interesting 
test to consider. In this case, the system that Alice sub- 
mits to Bob will be entangled with one that remains in 
her possession. Because of this entanglement, successful 
error-free state discrimination does not imply success- 
ful disturbance-free state spying. Although it is possible 
to achieve error-free discrimination of mixed states with 
some probability [2(J , having classical knowledge of which 
mixed state was prepared is insufficient to re-prepare a 
purification of that state. 

There are clearly many interesting questions that re- 
main to be answered about the task of state spying. 

X. APPLICATIONS AND OPEN QUESTIONS 

It is obvious that the security analyses of the WCF 
protocols we have presented throughout the paper require 
determining the optimal degree of success that can be 
achieved in a variety of state targeting tasks. This is also 
true for the security analysis of protocols for other two- 
party cryptographic tasks such as strong coin flipping 
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01 EI El Ell j partially binding and partially concealing 
bit commitment @, 0, E| , and bit escrow Q . 

Quantum two-party protocols are especially signifi- 
cant because in classical information theory there are 
no two-party protocols which offer information-theoretic 
security, that is, security which relies on the laws of 
physics rather than on computational intractability as- 
sumptions. In the quantum context, there exist two- 
party protocols that can guarantee to each party that 
if they follow the honest protocol, their opponent can- 
not bias the outcome against them more than a certain 
amount Moreover, there exist quantum pro- 

tocols that can guarantee to each party that if their op- 
ponent cheats, then there will be a non-zero probability 
of detecting this fact0, E|. We call these two types of 
security bias-resistance and cheat-sensitivity respectively. 
Our results have bearing on both. Specifically, the maxi- 
mum control specifies the degree of bias-resistance, while 
the maximum disturbance-free control, and the optimal 
control-disturbance trade-off specify the degree of cheat- 
sensitivity that is offered by a protocol. 

The problem we have considered here can be general- 
ized in many ways. First, one could consider the case 
where the prior probabilities of different states being the 
target state are unequal. Most of our results are eas- 
ily generalized to this case. Second, one could consider 
different sorts of tests, in particular, tests that are not 
associated one-to-one with states, in the sense that such 
a test could be passed with certainty by more than one 
state. For instance, one could consider support tests and 
convex decomposition tests for mixed states (defined in 
section rVlj) . Some results on the degree of control that 
can be achieved in state targeting for convex decompo- 
sition tests can be found in Rcfs. H@? ]. Finally, one 
could imagine that the target state (or target test) could 
be chosen from a set of states (tests) with more than two 
elements. Answering such questions will shed light on 
whether various existing protocols for two-party crypto- 
graphic tasks can be improved by modifying the sort of 
state targeting that is faced by a cheater. 



XI. DISCUSSION 

We have presented an introduction to a quantum infor- 
mation theoretic primitive we term state targeting. We 
have argued that this is a primitive task in quantum in- 
formation, in the same sense that state estimation is a 
primitive task. Indeed, we have shown that state target- 
ing has a natural dual in the context of state estimation, 
namely, the task of state spying, which occurs when the 
estimator is interested in gaining information about a 
system while minimizing the disturbance that this en- 
tails. We have solved a variety of optimization problems 
associated with state targeting. In the process, we have 
derived a generalization of Uhlmann's theorem and have 
shown how the fidelity can arise in a natural operational 
context. We end by identifying which aspects of state 
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FIG. 4: A pair of non-orthogonal classical probability distri- 
butions. 



targeting can be deemed truly quantum. 

If one adopts the view that quantum states are states 
of knowledge, rather than physical states [2^, what is 
analogous to a quantum state in classical mechanics 
is a probability distribution, and what is analogous to 
non-orthogonality of quantum states is non-disjointness 
of probability distributions, where two distributions are 
non-disjoint if there exists a non-empty subset of the 
physical state space to which they both assign non-zero 
probability. A pair of non-disjoint distributions are de- 
picted in Fig. 

By the lights of this analogy, the task of state esti- 
mation has a natural classical analogue. Specifically, the 
task of correctly identifying which of a non-orthogonal 
pair of quantum states describes a system is analogous 
to the task of correctly identifying which of a non-disjoint 
pair of probability distributions describes a classical sys- 
tem, that is, of identifying whether the system was pre- 
pared by drawing its physical state at random from one 
or another of a pair of non-disjoint probability distribu- 
tions. Just as the quantum discrimination task cannot 
be accomplished with certainty, neither can this classical 
discrimination task. The reason is that the physical state 
of the system has some probability of lying in the over- 
lap of the two probability distributions (the region Iq H I\ 
in Fig. 0J, and this is consistent with both preparations. 
Thus, even a measurement that completely determined 
the physical state of the system could not reveal which 
preparation was implemented. Nonetheless, just as in 
quantum mechanics, there is a probability greater than 
1/2 of a correct estimation, and a non-zero probability 
of error-free discrimination. Specifically, if one measures 
the physical state of the system, and finds it in the re- 
gion outside the overlap of the distributions (outside of 
To nil), then one knows with certainty which distribution 
describes the system. 

Similarly, there is a classical analogue for the task of 
state targeting. The target quantum state is replaced by 
a target probability distribution. Alice submits a system 
to Bob, then learns the identity of the target distribu- 
tion, announces a distribution to Bob, and Bob tests the 
submitted system for being described by the announced 
distribution. The simplest way for Bob to test for a dis- 
tribution is to test the system for being in the support 
of the distribution, that is, for being in the subset of the 
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physical state space that is assigned non-zero probability 
by the distribution. For instance, one tests for Pb(x) by 
verifying whether x lies in region depicted in Fig. 01 
It is now clear that Alice can achieve some non-trivial 
control. For instance, if she initially submits a system 
prepared according to po (x) , but the target distribution 
is pi (x) , then she still has some probability of passing a 
test for pi(x). Specifically, her probability is the integral 
of po (x) in the region Iq n I\ . 

For both state estimation and state targeting, there are 
differences between what can be achieved in the quantum 
and the classical contexts. 

In the case of estimation of classical probability dis- 
tributions, one does not necessarily alter the probability 
distribution by acquiring information about it, and thus 
one does not alter the probability of passing subsequent 
tests. For instance, if the distribution is Pb{x), then the 
fact that someone measures whether x is in the interval 
Iq or not does not change the fact that the system will 
be found in the interval h when tested. On the other 
hand, gaining information about which of a pair of non- 
orthogonal states describes a quantum system does in- 
fluence the probability that this system will subsequently 
pass a test for the state in which it was initially prepared. 

In the case of classical distribution targeting, there is 
a strategy that allows one to pass the test for the target 



state with certainty. For instance, if the target distri- 
bution is one of Po(x) or pi(x), then Alice can simply 
prepare the system in a physical state x € Jo H I\ and 
be certain to pass both the test for po(x) (being in the 
interval Iq) and the test for p\{x) (being in the interval 
ii). One can say that Alice achieves complete control 
in this case. On the other hand, in the quantum case, 
such complete control is not possible because no quan- 
tum state can pass the test for each of two non-orthogonal 
pure states with certainty. 

Thus, if one takes the view that quantum states are 
states of knowledge, what is surprising about quantum 
state estimation is not that one cannot achieve an error- 
free discrimination of non-orthogonal states with cer- 
tainty but rather that one cannot gain information with- 
out incurring a disturbance. Similarly, what is surprising 
about quantum state targeting is not the possibility of 
achieving a non-trivial control, but rather the impossibil- 
ity of achieving complete control, that is, the impossibil- 
ity of achieving successful state targeting with probabil- 
ity 1 , since this is what one would expect from examining 
the analogous classical task. 

Recognizing this difference between the classical and 
quantum tasks is likely to be useful in devising quan- 
tum information processing protocols that are provably 
superior to their classical counterparts. 
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APPENDIX A: DERIVATION OF EQS. @ AND 

(irni) 

If the states p, \ipo) and arc represented by Bloch 
vectors r, clq, and ai respectively, then 1/ (ipi,\ P -1 \i>b) 
= (1 - |f| 2 )/2(l - f ■ a b ), and Eq. JSJ) becomes 
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Extrcmizing Cdf with respect to variations in r, we obtain 

(1 - ?■ d ) 2 ((1 - r ■ d )2f + (1 - |ff a ) 
+(1 - f ■ aif ((1 - r ■ d l )2f+ (1 - |ff Si) 







and the measurement on the system may be made condi- 
tional upon the state of this message system. Thus, one 
can understand the convex decomposition test for Gb as 
a PVM mesurement {Gb, I — Gb} where 



G b = ^\b,k) (M| 



%,k) \<Pb,k\ 



(B2) 



One can then easily verify that the solution, r° pt , lies on 
the bisector of do and Si, that is, r° pt ■ (do x di) =0 and 
r° pt ■ do = r° pt • &i, or equivalcntly, 



r° pt = |r° pt | 



d + di 
|d + di| 



and has length 



1 + d • di 



1 - 



1 — do • di 



(A2) 



(A3) 



Translating these expressions from the Bloch sphere rep- 
resentation to the Hilbert space representation yields 
Eq. (jTU|) . Finally, plugging r° pt into Eq. IjAlfl we obtain 
Eq. ©. 



APPENDIX B: COMPARISON BETWEEN 
CONVEX DECOMPOSITION TESTS AND 
PURIFICATION TESTS 

The purification test for the mixed state Ob is a PVM 
measurement {Eb, I — Eb} where 



E b = \i'b) (A\ 



(Bl) 



with \ipb) a purification of Gb- Alice's maximum control in 
state targeting for two mixed states, (To and a\, assuming 
purification tests is 



G 



max 5 Tr (m®U b ) |V) (VI (I® Ut) 



b=0 
1 



max J2%m\(I®U b )\1>) 
m,u ,Ui ^ 

m ax Q^^o, p) 2 ] + ^F(a 1 ,pf 



where we have used Uhlmann's theorem, Eq. 1)18(1 . Note 
that the choice of purifications is unimportant since the 
probability of passing the test does not depend on this 
choice; the optimization yields an expression depending 
only on the reduced density operators. 

Suppose (7b has a convex decomposition {(pb,k, \4>b,k))}- 
Typically, in a convex decomposition test Alice sends Bob 
a classical message containing b and fc, and then Bob mea- 
sures the projector onto \4>b,k) ■ However, one can think of 
Alice's classical message as being conveyed by an orthog- 
onal set of states {|&, fc)} of a quantum "message" system, 



Alice's maximum control for such a test is 
l 

C co „= max ^\l^(G b {I®U b )\ij}){^\{I®Ul 



\i>),u ,Ui 



6=0 



Now, note that the state 

\Xb) = ^2 VPb^ \b, k) |0 6 , fe ) , 



(B3) 
(B4) 



which is a purification of Cf,, is an eigenstate of Gb- Thus, 



G b = \xb) (xbl + r, 



(B5) 



for some positive operator T. 

It follows that for positive A, Tr(G b A) > 
Tr(lxh) (xb\ A). Using this, we obtain 



C con > max J2%{xb\(I®U b )\il)) (B6) 
W> u °- U i £Tq 

But because the probability of passing a purification test 
is independent of the choice of purifications, the right 
hand side is simply C pur , and we have 



Ccon _^ Cpur- 



(B7) 



Thus, state targeting with convex decomposition tests 
is always as easy, or easier, than state targeting with 
purification tests. 



APPENDIX C: DERIVATION OF EQS. <j20j» AND 

We begin by deriving Eq. (J2UJ, i.e. that the fidelity 
satisfies 

max (F 2 (p, a) + F 2 (p, w)) = l + F {a, to) . (CI) 

p 

By Uhlmann's theorem we can re-express the left-hand 
side of Eq. I|C1J| in terms of arbitrary purifications 
\tp) , \x) and |0) of p, a and w, 



LHS = m&x (m&x\(x\U <Z> I \i))\ 2 + nrnx\(cj)\V ® I \ip)\ 2 

(C2) 

We now invert the order of the maximizations to obtain 
LHS = max max (|( X '|V)| 2 + I W)| 2 ) , (C3) 
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where 



This becomes 



IX) 



tf®I\ X ) 



LHS = maxmax|(V.| (|x') (x'l + W) (<f>'\) (C4) 
u,v |v»> 

= maxA—dx'Xx'l + l^^'l)- 

where A max (^4) is the maximum eigenvalue of A. Since 

A max (|x')(x'l + I0')(0'l) = l + I(x>')l- (C5) 
we have 

LHS = l + max\( X \UVi ® I\<f>)\ (C6) 
= 1 + F(u,a), 



where in the last step we have applied Uhlmann's theo- 
rem, Eq. (UHJ. ■ 

Next, we prove Eq. (|2ip. i.e. that the density operator 
p that achieves the maximum in Eq. IClfl . is 



opt 



UI + a + \foU + y/ujU'y/a 



2(l+*>,w)) 

where 

U = \ \/uj\ /r a\ 1 ^fa\JTo. 
We shall require the following lemma. 



(C7) 



(C8) 



Lemma Consider two density operators, a and ui defined 
on a d dimensional Hilbert space TI. Let TC also 
be a d dimensional Hilbert space. The state \<p) £ 
TC ' ®TL defined by 



(I®V^)J2\ek)\fk), 



(C9) 



fe=i 



where {|e/c)} fc=1 is an orthonormal basis for TC and 

i s an orthonormal basis for TC, is a pu- 
rification of ui. Furthermore, any state of the form 



|x> = (J®v^)X>*>l/*>, 



fc=i 



where V is the unitary operator 
V = | y/ujy/a\ 1 VoVcJ + V nuU 



(CIO) 



(Cll) 



is a purification of a that is maximally parallel to 
\4>) . Note that |A| = VaTK, S" 1 is the inverse of 
B on its support, and V^ u ii(a) is any unitary trans- 
formation on the null space of A. Note also that an 
arbitrary phase factor could be incorporated into 

lx). 



Proof. It is easy to verify that |</>) and |x) are indeed 
purifications of ui and a, since 



Tr 



H 



*;=i 

UI, 



and 



Tr H \x){x\ = Xiv^l/fcXM^V? 
fc=i 

= s/aVV^y/a 
= v, 

where we have used the completeness of the {|/fc)} and 
the unitarity of V. Second, \<f>) and |x) are maximally 
parallel since 

Mx)\ 

k 

= \Tr H {^/aVy/uj) \ 

= Tr H (ya 

= Tr H | y/uj\/a\ 
= F(ui,a). 



We are now in a position to prove Eq. (|C7(1 . To begin, 
note that the that achieves the maximum in Eq. (|C4|) 
is simply the eigenvector of |x') (x'l + 10') (<P'\ associated 
with the maximum eigenvalue, 



|V>° pt ) 



\X 



W) 



V2y/1+\( X 'W)V 



(C12) 



where we have chosen phases such that (x'\4>') 1S rea l- 

The U and V that achieve the maximum in Eq. (|C6|1 
are any pair U opt , V° pt such that 

\(x\u opt v opt ^ ® I 



= F(ui,a) 



(C13) 



which implies that the states |x') and \4>') that are defined 
in terms of a particular U° pt and V opt are maximally 
parallel. A particular pair of purifications of a and ui that 
are maximally parallel is provided by lemma 2. Taking 
Eqs. (|C9j) and l|C10j) to define \(f>') and |x') , we obtain 



|V opt ) 



(/®(Vw + V^O)ELile*)|/*) 



2jl 



(C14) 



IW)I 

This state allows one to achieve the maximum control. 
Its reduced density operator on Ti is 

,°Pt - Tr w |</; opt ) (<A° pt | 

2(1 + F(a,ui)) 
lo + a + ^/(tV^uj + ^/ujV^ \fa 



P 



2{l + F{a,u)) 
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Noting that V^V m n(^V^)^ = V^ nu ii(V^A?)^ = °. we have the desired result. 



